What belongs in a cybersecurity after-action report

A cybersecurity after-action report earns its status as a defensible record when it does more than summarize a discussion. It states the exercise objectives, records what participants observed against each one, and assigns every corrective action to a named owner with a due date. A tabletop exercise after-action report that stops at "lessons learned" leaves the organization with narrative and no accountability. The sections below describe what a cybersecurity after-action report template contains and why each part matters to counsel, boards, and incident response leaders reviewing the document later.

What is an after-action report, and how does it differ from a review?

An after-action report is the formal written document that captures the findings after a drill or an actual event, according to AlertMedia. It is distinct from the after-action review, which is the structured discussion where participants analyze what happened, why it happened, and how to improve. AlertMedia describes the two as different parts of the same improvement process: the review is the conversation, and the report is the record. A related step is the hot wash, the immediate debrief that feeds observations into the written report.

The distinction matters for a defensible record. A review that produces no report leaves nothing to audit, and observations fade once teams return to routine work. AlertMedia frames this directly, noting that without a structured review and documented report valuable lessons fade and the same gaps resurface in the next event. Tyson Martin describes the tabletop exercise after-action report as the structured document that captures what happened during a TTX and what the findings revealed.

The sections that make an after-action report defensible

The federal model most cybersecurity teams reference is the After-Action Report/Improvement Plan, or AAR/IP. The City of Los Angeles used this format for its 2016 Cyber Security Tabletop Exercise, conducted on February 23, 2016, with a publication date of April 25, 2016. That two month gap between exercise and published report is itself a record point: it shows the document was drafted, reviewed, and formally approved rather than filed and forgotten.

A cybersecurity after-action report template that supports later scrutiny generally carries these sections:

1. Exercise overview. The exercise name, dates and times, sponsor, and scope. The Los Angeles report recorded a start of exercise at 8:00 a.m. and end of exercise at 12:00 p.m. on the exercise date, with a defined scope tied to testing the city's planning and response capabilities against a cyber attack on city technology.
2. Participants and roles. The departments, teams, and external agencies involved. The Los Angeles exercise named its Cyber Intrusion Command Center working group, its Cyber Incident Response Team, its Emergency Operations Center policy leadership and planners, and supporting agencies including the Los Angeles Police Department, the U.S. Secret Service, and the FBI.
3. Objectives. The capabilities the exercise set out to test. CISA's After-Action Report/Improvement Plan template states an objective at the top of a page, a format Stacey Champagne highlighted on LinkedIn.
4. Strengths observed. What went right against each objective. Champagne notes the CISA template captures strengths observed in trying to complete an objective, and argues it is as important to identify what went right as what went wrong so effective practices continue.
5. Areas for improvement, with analysis and recommendations. CISA's template ties each area of opportunity to reference materials such as policies, procedures, and laws, then provides analysis and recommendations for each one, according to Champagne.
6. The improvement plan. The corrective actions themselves, addressed below.

The AlertMedia after-action report guidance frames the goal of the review process as ascertaining how the event went, what went well, and areas of improvement, leading to a concrete plan for improving the response should another similar incident occur.

Why owned corrective actions turn observations into accountability

The section that separates a defensible report from a discussion summary is the improvement plan with assigned ownership. Fire and Life Safety, Inc. President and CEO Stan Szpytek, speaking on The Employee Safety Podcast as quoted by AlertMedia, advised organizations to cite strengths, vulnerabilities, gaps, and opportunities for improvement, then make changes to their plans based on what people have learned. Making changes requires someone to own each change.

The Los Angeles model builds this in through tracking. Operations Division Chief Rob Freeman recommended that the Emergency Management Committee approve the AAR/IP and forward it to the Emergency Operations Board for approval, and stated that the Emergency Management Department would track areas recommended for improvement and report back through the committee and board. That is the accountability loop a corrective action section is meant to create: an identified gap, an owner, a governance body that receives the follow up, and a record that the item was tracked to closure. A recommendation with no owner and no reporting path is an observation, not a corrective action.

For a general counsel or CISO reviewing the document months later, the tradeoff is concrete. A report that logs each corrective action against a named owner, a reference authority, and a review date shows an organization acting on what it found. A report that records only narrative observations documents that the organization identified a gap and leaves open whether it did anything about it. The second version can be worse than no report, because it memorializes awareness without response.

How the report connects to recognized frameworks

Tying corrective actions to reference materials is what links the report to external standards. Champagne notes the CISA template ties areas of opportunity to policies, procedures, and laws. AlertMedia describes cybersecurity tabletop exercises as directly supporting the NIST Cybersecurity Framework by testing and validating incident response guidelines, particularly within the Respond and Recover functions, and places tabletop exercises within the NIST Incident Response Lifecycle under both the preparation and testing phase and the improvement phase.

The report is where the improvement phase is documented. When each area for improvement in the report cites the policy, procedure, or requirement it maps to, the document shows not only that a gap exists but which control or obligation the gap touches. Champagne also notes that the CISA template, though designed for tabletop exercises, can be adapted for actual incidents with a couple of adjustments, so an organization can keep one consistent format across drills and real events.

What a strong report avoids

A defensible after-action report avoids three failure modes drawn from the source material. First, it avoids the missing-record problem AlertMedia describes, where teams rush back to business as usual and lessons fade. Second, it avoids strengths-blindness. Champagne stresses recording what went right so effective actions continue, which a gaps-only report loses. Third, it avoids orphaned recommendations by assigning ownership and a reporting path, as the Los Angeles department did by committing to track improvements and report back to its governing boards.

The persistent gap these reports address is training itself. AlertMedia cites reporting that about one third of organizations do not offer cybersecurity training, even though half of those employees have access to critical data. A tabletop exercise closes part of that gap only if the after-action report captures the objectives tested, the strengths and shortfalls observed, and the corrective actions owned and tracked to completion. Without those sections, the exercise happened, but the record cannot show what changed because of it.